logging host is a Cisco IOS command that configures an external Syslog server to receive messages from a network device. The device continues logging to other destinations, including the console, VTY lines, and logging buffer. section 7.1.3
Key configuration facts:
- Configure the destination with logging host ip-address. section 7.1.3
- Use of host is optional: logging ip-address has the same effect, but running-config displays logging host ip-address. section 7.1.3
- Send standard Syslog messages to UDP port 514; Syslog over TLS uses TCP port 6514 but is outside the stated exam detail. section 7.1.3
- Use logging trap to control server logging; specifying the server address is also required. section 7.3
Configure a Syslog server
R1(config)# logging host 192.168.1.50 R1(config)# logging trap These commands identify 192.168.1.50 as the external destination and enable server-directed Syslog logging. section 7.1.3 section 7.3
SW1# show logging
. . .
Console logging: level debugging, 5014 messages #1
logged, xml disabled, filtering disabled #1
Monitor logging: level debugging, 1080 messages #1
logged, xml disabled, filtering disabled #1
Buffer logging: level debugging, 4500 messages #1
logged, xml disabled, filtering disabled #1
. . .
Trap logging: level informational, 18 message lines logged
Logging Source-Interface: VRF Name:
Log Buffer (4096 bytes): #2
. . .
Sep 18 10:35:06.528: %SEC_LOGIN-5-LOGIN_SUCCESS: Login
Success [user: jeremy] [Source: 192.168.1.224]
[localport: 22] at 19:35:06 JST Mon Sep 18 2023
Sep 18 10:35:14.539: %SYS-5-CONFIG_I: Configured from #3
console by jeremy on vty0 (192.168.1.224) #3
#1 Console, monitor (VTY line), and buffer logging are enabled by default.
#2 The logging buffer is 4,096 bytes in size.
#3 The most recent messages are shown at the bottom of the output.
Use show logging to inspect logging destinations and stored messages; Trap logging identifies server-directed logging, while console, monitor, and buffer logging appear separately. section 7.1.3
